fix(e2e): restore shared CLI artifact boundaries

[cv]

Summary

At base SHA c6713c9dd17a9682654713ccb6829b8714f1b307, the E2E CLI artifact packages repository-root dist/ and all of nemoclaw/dist/.
It validates only sandbox-name.cjs among the shared modules.

This change keeps repository-root dist/ and limits the plugin payload to nemoclaw/dist/shared/.
The restore action requires all three shared modules to be nonempty regular files before CLI startup.
It rejects archive members outside the allowed directories, existing destination paths, and a nemoclaw/ parent that is a symbolic link.

Related Issue

Follow-up to #7915.

Changes

• Require dist/nemoclaw.js, dist/build-identity.json, and three compiled shared CLI modules before artifact publication.
• Package openshell-policy-boundary.cjs, sandbox-name.cjs, and snapshot-sanitizer-boundary.cjs under nemoclaw/dist/shared/.
• Restrict extraction to repository-root dist/ and nemoclaw/dist/shared/.
• Reject traversal, symbolic links, special files, incomplete output, existing destination paths, and a nemoclaw/ parent that is a symbolic link.
• Validate every required module before moving either restored directory into the workspace.
• Pin each E2E restore step to action commit d34b11e8b895760d6505d54e2cfc520332cb2a9c.
• Add regression tests for required modules, archive members, destination paths, and restore rejection.
• Document the artifact contents and restore checks in test/e2e/README.md.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This changes internal GitHub Actions behavior. test/e2e/README.md documents the internal E2E artifact contract.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Independent review passed all nine categories for PR commit 39d5713cf40b81836d80e21bc9d2e8d2e8323074 against base SHA c6713c9dd17a9682654713ccb6829b8714f1b307. Refer to Sensitive-Path Security Review.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: No waiver. Required checks must pass before merge.

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: At PR commit 39d5713cf40b81836d80e21bc9d2e8d2e8323074 against base SHA c6713c9dd17a9682654713ccb6829b8714f1b307, I reviewed the complete five-file diff, terminology correction, immutable action repin, and live PR body under WRITING.md, the Controlled Word List, and the shared documentation review contract. test/e2e/README.md accurately documents the internal artifact contract. This change requires no public documentation under docs/. GitHub Actions is authoritative; required checks are running.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable; scripts/prepare-dgx-station-host.sh does not change.
• Station profile/scenario: Not applicable.
• Result: Not applicable.
• Supporting evidence: Not applicable.

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub — all 27 commits appear as Verified.
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable.
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — required GitHub Actions checks have not all passed for PR commit 39d5713cf40b81836d80e21bc9d2e8d2e8323074.
• Applicable broad gate passed — required GitHub Actions checks have not all passed for PR commit 39d5713cf40b81836d80e21bc9d2e8d2e8323074.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

Sensitive-Path Security Review

Independent review passed for PR commit 39d5713cf40b81836d80e21bc9d2e8d2e8323074 against base SHA c6713c9dd17a9682654713ccb6829b8714f1b307.

1. Secrets and credentials: PASS. No secret, credential, permission, or credential-custody behavior changes.
2. Input validation and data sanitization: PASS. The action validates provenance identities, artifact and payload digests, archive paths and entry types, destination paths, required files, and build identity before activation.
3. Authentication and authorization: PASS. Repository, candidate commit, workflow commit, run ID, and run-attempt bindings remain fail-closed. No authorization path changes.
4. Dependencies and third-party libraries: PASS. No dependency or lockfile changes. All 62 consumers use action commit d34b11e8b895760d6505d54e2cfc520332cb2a9c. Its action blob matches the reviewed action and SHA-256 value f90d4532a64473817b183856e225b401b201d71aaafa75bd7cf8d63a3deeb76f.
5. Error handling and logging: PASS. Validation errors stop restoration before the live test. Logs contain no credentials or raw provenance, and the temporary extraction directory is removed.
6. Cryptography and data protection: PASS. Artifact, payload, source-tree, lockfile, and build-identity checks use SHA-256 and immutable commit SHAs.
7. Configuration and security headers: PASS. No workflow permission, secret, network policy, exposed service, or security-header changes. Archive scope and path checks are more restrictive.
8. Security testing: PASS. Tests execute the action Bash control and cover identity, digest, archive, path, file-type, destination, symbolic-link, build-identity, immutable-pin, action-content, and consumer-restoration failures.
9. System security: PASS. The action stages content in a private temporary directory, validates it before activation, rejects destination substitution, and adds no alternate restore path. The validator binds the checked-in action to the immutable workflow pin.

GitHub Actions

GitHub Actions is authoritative for PR commit 39d5713cf40b81836d80e21bc9d2e8d2e8323074 against base SHA c6713c9dd17a9682654713ccb6829b8714f1b307.
Required checks must pass before merge.
No required check has a maintainer waiver.

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The E2E CLI artifact now packages nemoclaw/dist/shared, restores it through a pinned action, and validates shared boundary files, pre-existing paths, and symlink escape cases in tests and workflow checks.

Changes

CLI artifact boundary flow

Layer / File(s)	Summary
Producer packaging contract .github/workflows/e2e.yaml, tools/e2e/cli-artifact-workflow-boundary.mts, test/e2e/README.md	The build checks the policy, sandbox-name, and snapshot-sanitizer boundary files. It packages nemoclaw/dist/shared with the CLI artifact.
Shared artifact restoration .github/actions/restore-e2e-cli-artifact/action.yaml, .github/workflows/e2e.yaml, tools/e2e/cli-artifact-workflow-boundary.mts, test/e2e/README.md	The restore action allowlists shared paths, rejects pre-existing nemoclaw/dist, validates shared files, and restores the directory into the workspace. The workflow uses the updated pinned action revision and hash.
Boundary fixtures and validation test/e2e/support/cli-artifact-workflow-boundary.test.ts	The tests cover shared-content extraction, missing boundaries, directory-valued entries, pre-existing directories, and symlink escape prevention.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• NVIDIA/NemoClaw#7943: Introduced the exact-commit CLI artifact restore flow extended here.
• NVIDIA/NemoClaw#8335: Modifies the same CLI artifact restore path, workflow, tooling, and tests for shared dist handling.
• NVIDIA/NemoClaw#8337: Updates the same E2E CLI artifact restore and boundary validation flow.

Suggested labels: area: ci, area: e2e, area: packaging, bug-fix

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: restoring shared CLI artifact boundaries for E2E workflows.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/e2e-cli-artifact-plugin-dist

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 456b7dd in the fix/e2e-cli-artifact... branch remains at 96%, unchanged from commit 1608281 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 456b7dd in the fix/e2e-cli-artifact... branch remains at 82%, unchanged from commit 1608281 in the main branch.

Show a code coverage summary of the most impacted files.

File	main 1608281	fix/e2e-cli-artifact... 456b7dd	+/-
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/onboard...-transaction.ts	94%	94%	0%
src/lib/sandbox...rce-identity.ts	87%	87%	0%

---

_{Updated August 05, 2026 20:13 UTC}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/actions/restore-e2e-cli-artifact/action.yaml:
- Around line 161-182: Reject a symlinked or non-directory nemoclaw parent
before restoring the artifact: in
.github/actions/restore-e2e-cli-artifact/action.yaml, validate the parent itself
before extraction and mv. Apply the same non-symlink-directory invariant in
tools/e2e/cli-artifact-workflow-boundary.mts at lines 167-175, update the
related contract assertions at lines 69-74 and 189-199, and add the
symlinked-parent fixture at lines 498-516 verifying restoration fails without
creating an external dist directory.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7d74bf44-e9a5-4a2c-994d-603824e899e4

📥 Commits

Reviewing files that changed from the base of the PR and between 2b90d18 and d7d3af2.

📒 Files selected for processing (4)

• .github/actions/restore-e2e-cli-artifact/action.yaml
• .github/workflows/e2e.yaml
• test/e2e/support/cli-artifact-workflow-boundary.test.ts
• tools/e2e/cli-artifact-workflow-boundary.mts

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed after a partial review · low confidence · 0 blockers · 0 warnings · 0 suggestions

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

1 semantic terminology decision

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• justified — shared module at test/e2e/README.md:70: Keep shared module for the required compiled files under nemoclaw/dist/shared/.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, security-posture

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cv]

The required E2E / PR Gate check could not validate PR commit SHA ef6b7a7cdcab708cecb7e045dfdf3cf0ec257e2d against the workflow on main.

Evidence:

• PR commit SHA: ef6b7a7cdcab708cecb7e045dfdf3cf0ec257e2d
• Workflow commit SHA: 2b90d18ceebd226dde687cfed861632f9df4a673
• Selected E2E run: https://github.com/NVIDIA/NemoClaw/actions/runs/31003668860
• The workflow invoked restore-e2e-cli-artifact@4b911e40f3f41ce500d69330ca9280b79ceede0f from main. It did not use the action at PR commit 186323bdb45e2266777b13eb6c48dac4600d8449.
• Artifact identity and download passed. The action restored only root dist/. The CLI check then failed with Cannot find module '../../nemoclaw/dist/shared/sandbox-name.cjs' before tests began.

PR code cannot change the workflow or action loaded from main. Another PR commit cannot make this workflow-only correction affect its own required check.

No check is waived. No admin bypass or merge is requested. Maintainer direction is required for a repository-approved bootstrap path that preserves the workflow trust boundary and the required check.

[cv]

Status for PR commit SHA f6209b1de70861b56eca70bda0805a5c61426528:

• Required PR checks passed.
• The E2E controller selected run 31004989837 from workflow commit SHA 2b90d18ceebd226dde687cfed861632f9df4a673 on main.
• cloud-inference and cloud-onboard failed at the literal Restore exact-commit CLI artifact step before target execution.
• PR code cannot change the workflow or composite-action pin loaded from main.

The workflow on main must be updated before the required check can validate this PR. No E2E result is waived. No admin bypass or auto-merge is requested. This PR is not approval-ready. Maintainer direction is required for the repository-approved bootstrap path.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e/support/cli-artifact-workflow-boundary.test.ts`:
- Around line 509-523: Update expectRestoreFailure to assert that both
destination boundaries, including nemoclaw/dist/, are absent after every failed
restore. Preserve the existing root dist/ assertion and add the corresponding
nested dist check so the invalid CLI entry point and shared module tests verify
cleanup before activation.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b8dc4d5d-4b2c-4aa1-9b82-2f1543212202

📥 Commits

Reviewing files that changed from the base of the PR and between f6209b1 and 0ed01ed.

📒 Files selected for processing (5)

• .github/actions/restore-e2e-cli-artifact/action.yaml
• .github/workflows/e2e.yaml
• test/e2e/README.md
• test/e2e/support/cli-artifact-workflow-boundary.test.ts
• tools/e2e/cli-artifact-workflow-boundary.mts

🚧 Files skipped from review as they are similar to previous changes (4)

• .github/actions/restore-e2e-cli-artifact/action.yaml
• test/e2e/README.md
• .github/workflows/e2e.yaml
• tools/e2e/cli-artifact-workflow-boundary.mts

[cv]

Repository gate audit for PR commit cd6fa344b239b7d3e54e4829c7a0373c86098e0a against base commit cbabb66bfc985f3474714f95bfbc6ec1992441f9:

• Product scope is confirmed.
• The nine-category security review passed.
• The documentation writer receipt records the PR commit.
• The DCO declaration and GitHub commit verification pass.
• GitHub reports no merge conflict.
• CodeRabbit, CI, and trusted E2E check 92356588134 pass.

GitHub did not accept an approval from the PR author. The PR requires approval from another maintainer and a human merge decision. No bypass or merge occurred.